Fortinet FCSS_SDW_AR-7.4 Online Practice Questions and Exam Preparation

Fortinet FCSS_SDW_AR-7.4 Online Questions & Answers

• Question 1:

  You are planning a new SD-WAN deployment with the following criteria:

  1.Two regions

  2.Most of the traffic is expected to remain within its region

  3.No requirement for inter-region ADVPN

  To remain within the recommended best practices, which routing protocol should you select for the overlays?

  A. OSPF for the routing within each region and EBGP between the regions.
  B. IBGP with BGP on loopback within each region and EBGP between the regions.
  C. IBGP with BGP per overlays within each region and IBGP with BGP on loopback between the regions.
  D. IBGP within each region and between the regions.
  B. IBGP with BGP on loopback within each region and EBGP between the regions.

  ---

  Explanation

  For SD-WAN deployments that span multiple regions--where most traffic is intra-region and there is no requirement for inter-region ADVPN--the best practice is to use IBGP with BGP on loopback interfaces for routing within each region and

  EBGP between the regions. This approach ensures robust and scalable routing, isolates regional routing domains, and enables policy control at region boundaries. BGP on loopback is preferred for its reliability and flexibility, as it enables

  peering that is not tied to specific physical interfaces. EBGP between regions allows each region to maintain independent routing policies and summarization, optimizing performance and manageability. By separating IBGP (intra-region) and

  EBGP (inter-region), you create a modular architecture that scales easily and simplifies fault isolation and troubleshooting.

  References:

  [FCSS_SDW_AR-7.4 1-0.docx Q10]

  Fortinet SD-WAN Reference Architecture Guide 7.4, "Regional Routing Best Practices"

  FortiOS 7.4 SD-WAN Overlay Design Guidelines

• Question 2:

  What are three key routing principles of SD-WAN? (Choose three.)

  A. Directly connected routes have precedence over SD-WAN rules.
  B. Policy routes have precedence over SD-WAN rules.
  C. SD-WAN rules are skipped if the best route to the destination is a static route
  D. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
  E. SD-WAN members are skipped if they do not have a valid route to the destination.
  B. Policy routes have precedence over SD-WAN rules.
  D. SD-WAN rules are skipped if the best route to the destination is not an SD-WAN member.
  E. SD-WAN members are skipped if they do not have a valid route to the destination.

  ---

  Explanation

  Fortinet outlines key SD-WAN routing principles:

  "Policy routes are always evaluated before SD-WAN rules, meaning if a policy route matches, SD-WAN steering is bypassed. If the best route for a destination is not via an SD-WAN member, SD-WAN rules do not apply, and members are

  ignored if they lack a valid route. This hierarchy ensures traffic always follows the most deterministic and valid path according to configuration."

  Understanding these principles is critical for correct SD-WAN and routing integration.

• Question 3:

  Refer to the exhibit.

  

  Which algorithm does SD-WAN use to distribute traffic that does not match any of the SD-WAN rules?

  A. All traffic from a source IP to a destination IP is sent to the same interface.
  B. All traffic from a source IP is sent to the same interface.
  C. All traffic from a source IP is sent to the most used interface.
  D. All traffic from a source IP to a destination IP is sent to the least used interface.
  A. All traffic from a source IP to a destination IP is sent to the same interface.

  ---

  Explanation

• Question 4:

  In a Fortinet SD-WAN dual-hub design, what is the role of the minimum-sla-meet-members setting?

  A. It defines the minimum number of tunnels required for active-active operation.
  B. It specifies the number of SD-WAN members that must meet the SLA before traffic is forwarded.
  C. It defines the number of backup tunnels required for redundancy.
  D. It determines the number of hubs that can participate in ADVPN shortcuts.
  B. It specifies the number of SD-WAN members that must meet the SLA before traffic is forwarded.

  ---

  Explanation

  This parameter enforces SLA compliance by requiring a specified number of links to meet SLA thresholds before forwarding. It ensures stability and avoids routing traffic over degraded links.

• Question 5:

  You are tasked with configuring ADVPN 2.0 on an SD-WAN topology already configured for ADVPN. What should you do to implement ADVPN 2.0 in this scenario?

  A. Update the IPsec tunnel configurations on the hub.
  B. Update the SD-WAN configuration on the branches.
  C. Update the IPsec tunnel configuration on the branches.
  D. Delete the existing ADVPN configuration and configure ADVPN 2.0.
  A. Update the IPsec tunnel configurations on the hub.

  ---

  Explanation

• Question 6:

  You have configured the performance SLA with the probe mode as Prefer Passive. What are two observable impacts of this configuration? (Choose two.)

  A. FortiGate passively monitors the member if TCP traffic is passing through the member.
  B. After FortiGate switches to active mode, the SLA performance rule falls back to passive monitoring after 3 minutes.
  C. FortiGate passively monitors the member if ICMP traffic is passing through the member.
  D. During passive monitoring, the SLA performance rule cannot detect dead members.
  E. FortiGate can offload the traffic that is subject to passive monitoring to hardware.
  A. FortiGate passively monitors the member if TCP traffic is passing through the member.
  C. FortiGate passively monitors the member if ICMP traffic is passing through the member.

  ---

  Explanation

  FortiGate passively monitors the member if TCP traffic is passing through the member # With Prefer Passive mode, FortiGate inspects existing traffic (like TCP flows) to measure performance metrics without generating its own probes.

  FortiGate passively monitors the member if ICMP traffic is passing through the member # Similarly, when ICMP flows exist, FortiGate uses them for SLA checks.

• Question 7:

  Exhibit A shows the system interface with the static routes and exhibit B shows the firewall policies on the managed FortiGate.

  

  Exhibit B C

  

  Based on the FortiGate configuration shown in the exhibits, what issue might you encounter when creating an SD-WAN zone for port1 and port2?

  A. port1 is assigned a manual IP address.
  B. port1 is referenced in a firewall policy.
  C. port2 is referenced in a static route.
  D. port1 and port2 are not administratively down.
  B. port1 is referenced in a firewall policy.

  ---

  Explanation

• Question 8:

  When you use the command diagnose sys session list, how do you identify the sessions that correspond to traffic steered according to SD-WAN rules?

  A. You identify sessions steered according to SD-WAN rules with the flag vwl.
  B. You cannot identify SD-WAN sessions. You must use the sdwar. session filter.
  C. You identify sessions steered according to SD-WAN rules with the data vwl_mbr_seq.
  D. You identify sessions steered according to SD-WAN rules with the data 3dwan_service_id.
  D. You identify sessions steered according to SD-WAN rules with the data 3dwan_service_id.

  ---

  Explanation

  When using the diagnose sys session list command, SD-WAN-specific session steering is indicated by the presence of the sdwan_service_id field in the session data. This identifier ties the session directly to a specific SD-WAN rule or

  service. As noted in the Fortinet documentation: "Sessions that are handled according to SD- WAN rules will include a service ID tag (sdwan_service_id) in their session listing. This allows administrators to correlate live sessions with SDWAN policy matches for troubleshooting and visibility." This is a crucial diagnostic tool, as it distinguishes between traffic managed by traditional routing and that explicitly controlled by SD-WAN steering logic, aiding in operational insight and

  troubleshooting.

  References:

  [FCSS_SDW_AR-7.4 1-0.docx Q15]

  FortiOS 7.4 CLI Reference, "diagnose sys session list: SD-WAN Service ID Tagging"

  SD-WAN 7.4 Concept Guide, Section: "Session Identification for SD-WAN Traffic"

• Question 9:

  Refer to the exhibits.

  

  The exhibits show the configuration for SD-WAN performance. SD-WAN rule, the application IDs of Facebook and YouTube along with the firewall policy configuration and the underlay zone status. Which two statements are true about the health and performance of SD-WAN members 3 and 4? (Choose two.)

  A. Only related TCP traffic is used for performance measurement.
  B. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.
  C. Encrypted traffic is not used for the performance measurement.
  D. FortiGate identifies the member as dead when there is no Facebook and YouTube traffic passing through the member.
  A. Only related TCP traffic is used for performance measurement.
  B. The performance is an average of the metrics measured for Facebook and YouTube traffic passing through the member.

  ---

  Explanation

• Question 10:

  Which two interfaces are considered overlay links? (Choose two.)

  A. LAG
  B. IPsec
  C. Physical
  D. GRE
  B. IPsec
  D. GRE

  ---

  Explanation

  Overlay links are logical tunnels that encapsulate data traffic over an underlay network. IPsec and GRE are tunnel-based overlay technologies used to create virtual links between network endpoints, whereas LAG and Physical interfaces belong to the physical or underlay layer.